[java-identity-provider] branch main updated: IDP-2216 - Option to randomize FriendlyName

Scott Cantor cantor.2 at osu.edu
Mon Dec 18 18:39:11 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d17e0da9cf5e54d988e99db2fdd48c4dbfa72bfa

The following commit(s) were added to refs/heads/main by this push:
     new d17e0da9c IDP-2216 - Option to randomize FriendlyName
d17e0da9c is described below

commit d17e0da9cf5e54d988e99db2fdd48c4dbfa72bfa
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Dec 18 13:39:08 2023 -0500

    IDP-2216 - Option to randomize FriendlyName
    
    https://shibboleth.atlassian.net/browse/IDP-2216
    
    Not random, but this appends the assertion ID to the values.
---
 .../shibboleth/idp/conf/relying-party-mddriven.xml | 16 +++++++
 .../config/AttributeQueryProfileConfiguration.java | 44 ++++++++++++++++++
 .../config/BrowserSSOProfileConfiguration.java     | 13 ++++++
 ...andomizeFriendlyNameProfileConfigPredicate.java | 54 ++++++++++++++++++++++
 .../impl/AttributeQueryProfileConfiguration.java   | 43 ++++++++++++++++-
 .../impl/BrowserSSOProfileConfiguration.java       | 33 +++++++++++++
 .../impl/AddAttributeStatementToAssertion.java     | 14 +++++-
 7 files changed, 214 insertions(+), 3 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
index 923f978a0..5061b6306 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/relying-party-mddriven.xml
@@ -459,6 +459,14 @@
                 <constructor-arg value="false" />
             </bean>
         </property>
+        <property name="randomizeFriendlyNamePredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="randomizeFriendlyName" />
+                </constructor-arg>
+                <constructor-arg value="false" />
+            </bean>
+        </property>
         <property name="proxyCountLookupStrategy">
             <bean parent="shibboleth.MDDrivenIntProperty" p:propertyName="proxyCount" />
         </property>
@@ -670,6 +678,14 @@
                 </constructor-arg>
             </bean>
         </property>
+        <property name="randomizeFriendlyNamePredicate">
+            <bean class="net.shibboleth.shared.logic.PredicateSupport" factory-method="fromFunction">
+                <constructor-arg>
+                    <bean parent="shibboleth.MDDrivenBoolProperty" p:propertyName="randomizeFriendlyName" />
+                </constructor-arg>
+                <constructor-arg value="false" />
+            </bean>
+        </property>
     </bean>
 
     <bean id="SAML2.ArtifactResolution.MDDriven" parent="AbstractMDDrivenSAML2Profile" lazy-init="true"
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
new file mode 100644
index 000000000..86e7b5d7b
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/AttributeQueryProfileConfiguration.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.saml2.profile.config;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+import net.shibboleth.shared.annotation.ConfigurationSetting;
+
+/**
+ * Configuration support for SAML 2.0 Attribute Query profile.
+ * 
+ * <p>Adds settings specific issuer role for SAML 2.0.
+ * 
+ * @since 5.1.0
+ */
+public interface AttributeQueryProfileConfiguration
+        extends net.shibboleth.saml.saml2.profile.config.AttributeQueryProfileConfiguration {
+
+    /**
+     * Gets whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to
+     * enable probing of invalid behavior by relying parties.
+     * 
+     * @param profileRequestContext current profile request context
+     * 
+     * @return true iff the FriendlyName should be randomized
+     */
+    @ConfigurationSetting(name="randomizeFriendlyName")
+    boolean isRandomizeFriendlyName(@Nullable final ProfileRequestContext profileRequestContext);
+
+}
\ No newline at end of file
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
index 745636ea4..b31f443e6 100644
--- a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/BrowserSSOProfileConfiguration.java
@@ -72,6 +72,19 @@ public interface BrowserSSOProfileConfiguration
     @ConfigurationSetting(name="skipEndpointValidationWhenSigned")
     boolean isSkipEndpointValidationWhenSigned(@Nullable final ProfileRequestContext profileRequestContext);
 
+    /**
+     * Gets whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to
+     * enable probing of invalid behavior by relying parties.
+     * 
+     * @param profileRequestContext current profile request context
+     * 
+     * @return true iff the FriendlyName should be randomized
+     * 
+     * @since 5.1.0
+     */
+    @ConfigurationSetting(name="randomizeFriendlyName")
+    boolean isRandomizeFriendlyName(@Nullable final ProfileRequestContext profileRequestContext);
+    
     /**
      * Gets the unmodifiable collection of audiences for a proxied assertion.
      * 
diff --git a/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/RandomizeFriendlyNameProfileConfigPredicate.java b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/RandomizeFriendlyNameProfileConfigPredicate.java
new file mode 100644
index 000000000..47f2b6aad
--- /dev/null
+++ b/idp-saml-api/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/logic/RandomizeFriendlyNameProfileConfigPredicate.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.saml.saml2.profile.config.logic;
+
+import javax.annotation.Nullable;
+
+import net.shibboleth.profile.config.ProfileConfiguration;
+import net.shibboleth.profile.context.RelyingPartyContext;
+import net.shibboleth.profile.context.logic.AbstractRelyingPartyPredicate;
+import net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration;
+import net.shibboleth.idp.saml.saml2.profile.config.BrowserSSOProfileConfiguration;
+
+import org.opensaml.profile.context.ProfileRequestContext;
+
+/**
+ * A predicate that evaluates a {@link ProfileRequestContext} and extracts the effective
+ * setting of {@link BrowserSSOProfileConfiguration#isRandomizeFriendlyName(ProfileRequestContext)}
+ * or {@link AttributeQueryProfileConfiguration#isRandomizeFriendlyName(ProfileRequestContext)}.
+ * 
+ * <p>Defaults to false.</p>
+ * 
+ * @since 5.1.0
+ */
+public class RandomizeFriendlyNameProfileConfigPredicate extends AbstractRelyingPartyPredicate {
+    
+    /** {@inheritDoc} */
+    public boolean test(@Nullable final ProfileRequestContext input) {
+        
+        final RelyingPartyContext rpc = getRelyingPartyContext(input);
+        if (rpc != null) {
+            final ProfileConfiguration pc = rpc.getProfileConfig();
+            if (pc instanceof BrowserSSOProfileConfiguration sso) {
+                return sso.isRandomizeFriendlyName(input);
+            } else if (pc instanceof AttributeQueryProfileConfiguration query) {
+                return query.isRandomizeFriendlyName(input);
+            }
+        }
+        
+        return false;
+    }
+
+}
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java
index f9a1406e2..db45bbe98 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/AttributeQueryProfileConfiguration.java
@@ -14,20 +14,29 @@
 
 package net.shibboleth.idp.saml.saml2.profile.config.impl;
 
+import java.util.function.Predicate;
+
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
+import org.opensaml.profile.context.ProfileRequestContext;
 import org.opensaml.profile.logic.NoConfidentialityMessageChannelPredicate;
 import org.opensaml.profile.logic.NoIntegrityMessageChannelPredicate;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.PredicateSupport;
 
 /** Configuration support for IdP SAML 2.0 attribute query profile. */
 public class AttributeQueryProfileConfiguration extends AbstractSAML2AssertionProducingProfileConfiguration
-        implements net.shibboleth.saml.saml2.profile.config.AttributeQueryProfileConfiguration {
+        implements net.shibboleth.idp.saml.saml2.profile.config.AttributeQueryProfileConfiguration {
     
     /** Name of profile counter. */
     @Nonnull @NotEmpty public static final String PROFILE_COUNTER = "net.shibboleth.idp.profiles.sam2.query.attribute";
-    
+
+    /** Whether the FriendlyName attribute should be randomized when encoding Attributes. */
+    @Nonnull private Predicate<ProfileRequestContext> randomizeFriendlyNamePredicate;
+
     /** Constructor. */
     public AttributeQueryProfileConfiguration() {
         this(PROFILE_ID);
@@ -42,6 +51,36 @@ public class AttributeQueryProfileConfiguration extends AbstractSAML2AssertionPr
         super(profileId);
         setSignResponsesPredicate(new NoIntegrityMessageChannelPredicate());
         setEncryptAssertionsPredicate(new NoConfidentialityMessageChannelPredicate());
+        randomizeFriendlyNamePredicate = PredicateSupport.alwaysFalse();
+    }
+
+    /** {@inheritDoc} */
+    public boolean isRandomizeFriendlyName(@Nullable final ProfileRequestContext profileRequestContext) {
+        return randomizeFriendlyNamePredicate.test(profileRequestContext);
+    }
+    
+    /**
+     * Set whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to
+     * enable probing of invalid behavior by relying parties.
+     * 
+     * @param flag flag to set
+     * 
+     * @since 5.1.0
+     */
+    public void setRandomizeFriendlyName(final boolean flag) {
+        randomizeFriendlyNamePredicate = PredicateSupport.constant(flag);
+    }
+    
+    /**
+     * Set condition to determine whether to randomize/perturb the FriendlyName attribute when encoding
+     * SAML 2.0 Attributes to enable probing of invalid behavior by relying parties.
+     * 
+     * @param condition condition to set
+     * 
+     * @since 5.1.0
+     */
+    public void setRandomizeFriendlyNamePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        randomizeFriendlyNamePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
     }
     
 }
\ No newline at end of file
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
index 078a5fb54..4e5440463 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
@@ -76,6 +76,9 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
     /** Whether the response endpoint should be validated if the request is signed. */
     @Nonnull private Predicate<ProfileRequestContext> skipEndpointValidationWhenSignedPredicate;
 
+    /** Whether the FriendlyName attribute should be randomized when encoding Attributes. */
+    @Nonnull private Predicate<ProfileRequestContext> randomizeFriendlyNamePredicate;
+
     /** Lookup function to supply proxyCount property. */
     @Nonnull private Function<ProfileRequestContext,Integer> proxyCountLookupStrategy;
 
@@ -163,6 +166,7 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
         forceAuthnPredicate = new ProxyAwareForceAuthnPredicate();
         checkAddressPredicate = PredicateSupport.alwaysTrue();
         skipEndpointValidationWhenSignedPredicate = PredicateSupport.alwaysFalse();
+        randomizeFriendlyNamePredicate = PredicateSupport.alwaysFalse();
         proxyCountLookupStrategy = FunctionSupport.constant(null);
         proxyAudiencesLookupStrategy = FunctionSupport.constant(null);
         proxiedAuthnInstantPredicate = PredicateSupport.alwaysTrue();
@@ -342,6 +346,35 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionProduc
         skipEndpointValidationWhenSignedPredicate = Constraint.isNotNull(condition, "Condition cannot be null");
     }
 
+    /** {@inheritDoc} */
+    public boolean isRandomizeFriendlyName(@Nullable final ProfileRequestContext profileRequestContext) {
+        return randomizeFriendlyNamePredicate.test(profileRequestContext);
+    }
+    
+    /**
+     * Set whether to randomize/perturb the FriendlyName attribute when encoding SAML 2.0 Attributes to
+     * enable probing of invalid behavior by relying parties.
+     * 
+     * @param flag flag to set
+     * 
+     * @since 5.1.0
+     */
+    public void setRandomizeFriendlyName(final boolean flag) {
+        randomizeFriendlyNamePredicate = PredicateSupport.constant(flag);
+    }
+    
+    /**
+     * Set condition to determine whether to randomize/perturb the FriendlyName attribute when encoding
+     * SAML 2.0 Attributes to enable probing of invalid behavior by relying parties.
+     * 
+     * @param condition condition to set
+     * 
+     * @since 5.1.0
+     */
+    public void setRandomizeFriendlyNamePredicate(@Nonnull final Predicate<ProfileRequestContext> condition) {
+        randomizeFriendlyNamePredicate = Constraint.isNotNull(condition, "Condition cannot be null");
+    }
+    
     /** {@inheritDoc} */
     @Nullable public Integer getProxyCount(@Nullable final ProfileRequestContext profileRequestContext) {
         final Integer count = proxyCountLookupStrategy.apply(profileRequestContext);
diff --git a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
index 0bbd06f3f..fdef694dd 100644
--- a/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
+++ b/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/saml2/profile/impl/AddAttributeStatementToAssertion.java
@@ -43,6 +43,7 @@ import net.shibboleth.idp.attribute.IdPAttribute;
 import net.shibboleth.idp.attribute.transcoding.AttributeTranscoderRegistry;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.idp.saml.profile.impl.BaseAddAttributeStatementToAssertion;
+import net.shibboleth.idp.saml.saml2.profile.config.logic.RandomizeFriendlyNameProfileConfigPredicate;
 import net.shibboleth.shared.annotation.constraint.NullableElements;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.service.ServiceException;
@@ -107,7 +108,18 @@ public class AddAttributeStatementToAssertion extends BaseAddAttributeStatementT
 
             assertion.getAttributeStatements().add(statement);
 
-            log.debug("{} Adding constructed AttributeStatement to Assertion {} ", getLogPrefix(), assertion.getID());
+            final boolean randomizeFriendlyName =
+                    new RandomizeFriendlyNameProfileConfigPredicate().test(profileRequestContext);
+            final String id = assertion.getID();
+            if (randomizeFriendlyName && id != null) {
+                log.debug("{} Will randomize FriendlyName attributes", getLogPrefix());
+                for (final Attribute a : statement.getAttributes()) {
+                    final String current = a.getFriendlyName();
+                    a.setFriendlyName(current != null ? current + id : id);
+                }
+            }
+            
+            log.debug("{} Adding constructed AttributeStatement to Assertion {} ", getLogPrefix(), id);
         } catch (final AttributeEncodingException e) {
             ActionSupport.buildEvent(profileRequestContext, IdPEventIds.UNABLE_ENCODE_ATTRIBUTE);
         }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list